EUVD-2026-88075
GHSA-vfgw-cw9x-j5hm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed p2pcam HTTP interface
-
ExploitSend request with over-long URI
-
ExecutionOverflow fixed stack buffer in parser
-
ImpactCrash camera service (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the Eyeplus 57.0.0.0308 device's p2pcam HTTP parser (the P2P camera web/HTTP service must be exposed to the attacker). No authentication and no user interaction are needed (PR:N/UI:N), and the trigger is simply an over-long URI in an HTTP request. The primary limiting factor is exposure: the impact demonstrated by the public PoC is a denial of service (device crash), and cameras are typically behind NAT/local networks unless deliberately port-forwarded or reachable via the vendor P2P cloud path - reducing the effective remote attack surface for many deployments. |
| Impact | The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC:N/VI:N/VA:H, score 7.7, E:P) describes a remotely reachable, unauthenticated, low-complexity flaw whose ONLY impact is availability - a denial of service, not code execution. This is important: although the CWE is CWE-121 (stack-based buffer overflow), a classification that often implies remote code execution, both the vendor's impact metrics (VC:N/VI:N/VA:H) and the sole public exploit reference ('EYEPLUS-8001-Long-URI-DoS.md') indicate the demonstrated outcome is a crash/DoS via an oversized URI, not confirmed RCE. Publicly available exploit code exists (VulDB + GitHub PoC). There is no EPSS score and no CISA KEV listing in the provided data, so there is no evidence of widespread or active exploitation - the E:P (Proof-of-Concept) exploit-maturity signal is consistent with a released PoC rather than in-the-wild use. Net: a genuinely low-barrier remote DoS against a niche IoT camera. The 7.7 headline is availability-driven; treat this as a real-but-narrow-impact issue (device crash), and explicitly verify with the vendor whether the stack overflow is actually exploitable for code execution, since CWE-121 leaves that door open even though the PoC only shows DoS. |
| Exploit ScenarioDerived | A remote attacker with network access to an exposed Eyeplus camera's p2pcam HTTP interface sends a request containing an over-long URI, overflowing a fixed-size stack buffer in the HTTP parser and crashing the service. A public PoC ('Long-URI-DoS') already demonstrates this, so no custom research is needed; the realistic demonstrated impact is device/service unavailability rather than confirmed remote code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 28, 2026
Remote unauthenticated denial of service in Eyeplus 57.0.0.0308 p2pcam HTTP parser allows an attacker who can reach the camera's HTTP/P2P service to crash the device by sending an over-long URI, exploiting a stack-based buffer overflow (CWE-121). Publicly available exploit code exists; CISA KEV does not list this CVE in the provided data, so it is not confirmed actively exploited. The vendor CVSS 4.0 score is 7.7 with PR:N/UI:N and only availability impact (VC:N/VI:N/VA:H), and the independent assessment likewise rates it as a denial-of-service flaw rather than code execution.
Earlier versions of this analysis (1)
An uncontrolled stack-based buffer overflow in the Eyeplus p2pcam HTTP parser (firmware 57.0.0.0308) lets unauthenticated remote attackers crash the device by sending a crafted oversized URI to its built-in web/HTTP service. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the attack needs no credentials, no user interaction, and no special configuration, but the impact profile (VC:N/VI:N/VA:H) is availability-only - this is a denial-of-service condition, not a confidentiality or integrity compromise. Publicly available exploit code exists (a GitHub advisory demonstrating a long-URI DoS against EYEPLUS-8001), so any reachable device running the affected firmware is at practical risk of being knocked offline; no evidence of confirmed active exploitation (CISA KEV) was provided at time of analysis.
RemediationAI
No vendor-released patched version is identified in the available data, so the priority is to remove attack surface: do not expose the Eyeplus p2pcam HTTP service to the internet, delete any port-forwarding, UPnP, NAT-PMP, or firewall rules that publish the camera, and place cameras on an isolated VLAN accessible only from trusted management hosts. If remote access is required, disable the vendor P2P/cloud path where possible and use a VPN or zero-trust proxy instead, accepting the loss of direct cloud convenience. Where a reverse proxy or WAF can be placed in front of the camera, enforce strict maximum HTTP request-line and URI length limits to reject the over-long URI trigger, understanding that this may break unusually long legitimate URLs but should not affect normal p2pcam operation. Monitor for unexpected reboots or crashes and contact the vendor for firmware updates; consult https://vuldb.com/vuln/410859 and https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-8001-Long-URI-DoS.md for the latest guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic stack-based buffer overflow (CWE-121) in the p2pcam HTTP parser used by Eyeplus firmware 57.0.0.0308. When the parser processes an HTTP request with an excessively long URI, it copies or otherwise handles the input without adequate bounds checking in a fixed-size stack buffer, corrupting stack memory and causing the service or device to crash. The CPE cpe:2.3:a:n/a:eyeplus:*:*:*:*:*:*:*:* identifies Eyeplus as the affected product, although the vendor field is unset; ENISA EUVD specifically lists Eyeplus 57.0.0.0308. The attack requires network reachability to the p2pcam HTTP service, but no authentication or user interaction (CVSS PR:N/UI:N). The assessed impact is availability only: confidentiality and integrity are not affected in the provided vectors, and the public PoC demonstrates a long-URI denial of service, not code execution.
Know when Eyeplus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Remote, low-complexity, unauthenticated HTTP-parser overflow whose only demonstrated impact is a service crash, so A:H with C:N/I:N; RCE not established.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in Eyeplus 57.0.0.0308. This affects an unknown function of the component p2pcam HTTP Parser. Such manipulation leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Technical POC Analysis
CWE-121, stack-based buffer overflow, in the p2pcam HTTP service listening on TCP port 8001.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Eyeplus 57.0.0.0308 p2pcam devices are vulnerable to a remote unauthenticated denial-of-service attack that can crash the camera, potentially disrupting physical security monitoring. With publicly available exploit code exists and no vendor patch, organizations relying on these cameras for surveillance face a high risk of service outages. Leadership should prioritize identifying and isolating affected devices to maintain security coverage.
No vendor-released patch identified at time of analysis; interim mitigations include network segmentation, firewall rules to restrict access to HTTP/P2P services, disabling unused services, and monitoring for device crashes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Unauthenticated snapshot disclosure in the Eyeplus IoT camera (version 57.0.0.0308) lets any attacker with network reach
Unauthenticated information disclosure in Eyeplus firmware 57.0.0.0308 lets remote attackers retrieve user account recor
Exploit-DB